2018
Sep
12
comment Best practices to protect public/private SSH key pair in web interface?
@hft well in my case the server will be doing the connection, nobody will connect to it so in this case there's only a single key pair (correct me if I'm wrong). Since the keys are public, I only have control over the private key the user created in my web interface so it's stored on the server and that's the one I'm concerned about. What would be the best way to protect it, yet still be able to use it to connect? any platform-based suggestion works.
Sep
12
comment Best practices to protect public/private SSH key pair in web interface?
Hi, thanks for your answer! Alright, that's good to know about the Public key. Regarding the private key, just compressing/encrypting with a server key is okay? The interface is protected AFAIK, I worked hard on it to allow uploads only from the user's profile. I'm thinking I can use OTP for upload confirmation, but I'm still concerned about the private key's security. What would you suggest I do in that case?
Sep
12
awarded  Commentator
Sep
11
comment Best practices to protect public/private SSH key pair in web interface?
Thanks for your reply @AndrolGenhald, okay so I might be a bit confused on how SSH works. Yeah I know the key is public, but I wasn't thinking it was too public for everyone to see (only the user, of course). So in this case, alright, let's do a plot twist and I encrypt the private key in the server. What should I use so a hacker can't see it (but I'll need to, for connecting)... or it doesn't matter? 'cause if they have access to the private key they can have access to the public one too. I'd like to protect my users's keys, either public or private. Now I'm concerned about the private key
Sep
11
asked Best practices to protect public/private SSH key pair in web interface?
2016
Oct
5
comment Can a MITM sniff and see TeamViewer's session?
Thanks for the link :) I did read the whole 3 parts, but I didn't think it was relevant since that part speaks of the 4-digit passcode, and TV now uses a 6-char code. After 3 versions later I think/hope they have fixed this issue
Oct
5
comment Can a MITM sniff and see TeamViewer's session?
I did read that, but it's not clear. Their servers may not read the data stream (who guarantees they don't, anyways?) but if I'm through a proxy or have a special app doing a MITM (such as Wireshark for example), that gets both clients's encryption key, can it decrypt the data stream? or I'm a bit confused here?. I mean, is the "public" part of the key only shared online and even if there is a proxy reading that, they can't do anything with it? am I right?
Oct
5
asked Can a MITM sniff and see TeamViewer's session?
2014
Sep
28
comment Chat encryption system avoiding protocol sniffing and then key+decryption replay?
Also, what @Sky says here is similar to what I want to archieve - If the browser holds the public key, and the private one is a hash generated by the user's entered password (DEADBEEF or FACEFEED), I can use a nonce to make that hash salt change (and instead of being incremental, use something else that the server and the client don't have to share in order to know, like Blizzard's token generator). Sounds good to me, what do you say?: security.stackexchange.com/questions/58715/…
Sep
28
comment Chat encryption system avoiding protocol sniffing and then key+decryption replay?
Alright, I can live with that since it's something I can't control, but I can try to make its job harder. Your suggestion intrigues me, could you please elaborate? as I understand it, the client A generates keyA from the public keyP (with a nonce?). MITM can't decrypt it, but when the message arrives to client B (and sees message + keyA), how does client B know the nonce used in order to decrypt the message? there must be some kind of "nonce synchronization" after each message is transferred, right?
Sep
28
comment Chat encryption system avoiding protocol sniffing and then key+decryption replay?
Yes, you're right too, and since I can't trust the client machine because it can be compromised that way, that's why I created the question here, to see if there is a way I can still encrypt the messages even if the secure channel is displayed by a MITM architecture.
Sep
28
comment Chat encryption system avoiding protocol sniffing and then key+decryption replay?
Well that's what I want to avoid. There are environments where someone can install the trusted CA of the SSL sniffing tool and unless you know about it and remove it, you're prone to be sniffed. I've thought about the nonce, but if you grab a log of the network packets, there's no need to go against the server because you already have the responses with the current nonce generated at that time, beating its purpose, am I right?
Sep
28
comment Chat encryption system avoiding protocol sniffing and then key+decryption replay?
You're right, but at least keyloggers and such are apps that you can (if you get the access) control and mitigate. It's easier (and less riskier) to kill those apps than breaking into the proxy/firewall to check if they are sniffing packets or not :P
Sep
28
comment Chat encryption system avoiding protocol sniffing and then key+decryption replay?
Yes, that's the problem. In some work, cyber-cafe environments and such, the owners have control over the computers and if they have the knowledge they can install the certificate into the root CAs of the PC and they'll be able to sniff. That's why I wanted to include an extra encryption on my part, without relying too much on HTTPS.
Sep
28
comment Chat encryption system avoiding protocol sniffing and then key+decryption replay?
Sure, here's what I found: blog.philippheckel.com/2013/08/04/…
Sep
27
awarded  Student
Sep
27
asked Chat encryption system avoiding protocol sniffing and then key+decryption replay?